Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-11-06 18:32:03 +00:00
parent 7dbfb1f72a
commit 165c6d3fa9
122 changed files with 1704 additions and 261 deletions
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-384"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -40,7 +40,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-611"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-863"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -40,7 +40,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-326"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-384"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-863"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4mvh-rcqj-42gx",
-  "modified": "2024-02-28T09:30:36Z",
+  "modified": "2024-11-06T18:31:03Z",
  "published": "2024-02-28T09:30:36Z",
  "aliases": [
    "CVE-2020-36780"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: sprd: fix reference leak when pm_runtime_get_sync fails\n\nThe PM reference count is not expected to be incremented on\nreturn in sprd_i2c_master_xfer() and sprd_i2c_remove().\n\nHowever, pm_runtime_get_sync will increment the PM reference\ncount even failed. Forgetting to putting operation will result\nin a reference leak here.\n\nReplace it with pm_runtime_resume_and_get to keep usage\ncounter balanced.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -43,7 +46,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-28T09:15:36Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5355-6wp2-29w4",
-  "modified": "2024-04-19T09:30:47Z",
+  "modified": "2024-11-06T18:31:02Z",
  "published": "2024-02-19T06:30:33Z",
  "aliases": [
    "CVE-2024-26328"
  ],
  "details": "An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -31,7 +34,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-19T05:15:26Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8wcv-54w6-5c6v",
-  "modified": "2024-02-21T09:31:00Z",
+  "modified": "2024-11-06T18:31:02Z",
  "published": "2024-02-21T09:31:00Z",
  "aliases": [
    "CVE-2023-42834"
  ],
  "details": "A privacy issue was addressed with improved handling of files. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -43,7 +46,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-21T07:15:47Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-g568-mc4g-cm6f",
-  "modified": "2024-02-29T03:33:18Z",
+  "modified": "2024-11-06T18:31:03Z",
  "published": "2024-02-29T03:33:18Z",
  "aliases": [
    "CVE-2024-26473"
  ],
  "details": "A reflected cross-site scripting (XSS) vulnerability in SocialMediaWebsite v1.0.1 allows attackers to inject malicious JavaScript into the web browser of a victim via the poll parameter in poll.php.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-29T01:44:19Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hpjc-53pc-jh5v",
-  "modified": "2024-02-21T15:30:45Z",
+  "modified": "2024-11-06T18:31:03Z",
  "published": "2024-02-21T15:30:45Z",
  "aliases": [
    "CVE-2024-22778"
  ],
  "details": "HackMD CodiMD <2.5.2 is vulnerable to Denial of Service.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-21T15:15:09Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-mw6g-mf3x-8xg2",
-  "modified": "2024-02-26T18:30:31Z",
+  "modified": "2024-11-06T18:31:03Z",
  "published": "2024-02-26T18:30:31Z",
  "aliases": [
    "CVE-2024-26468"
  ],
  "details": "A DOM based cross-site scripting (XSS) vulnerability in the component index.html of jstrieb/urlpages before commit 035b647 allows attackers to execute arbitrary Javascript via sending a crafted URL.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-26T16:27:59Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2rqp-mqvp-96gv",
-  "modified": "2024-03-27T06:30:31Z",
+  "modified": "2024-11-06T18:31:04Z",
  "published": "2024-03-27T06:30:31Z",
  "aliases": [
    "CVE-2023-45929"
  ],
  "details": "S-Lang 2.3.2 was discovered to contain a segmentation fault via the function fixup_tgetstr().",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-120"
    ],
-    "severity": null,
+    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-27T04:15:11Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4c64-w6qg-97qw",
-  "modified": "2024-03-03T00:30:32Z",
+  "modified": "2024-11-06T18:31:03Z",
  "published": "2024-03-03T00:30:32Z",
  "aliases": [
    "CVE-2023-52566"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential use after free in nilfs_gccache_submit_read_data()\n\nIn nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the\nreference count of bh when the call to nilfs_dat_translate() fails.  If\nthe reference count hits 0 and its owner page gets unlocked, bh may be\nfreed.  However, bh->b_page is dereferenced to put the page after that,\nwhich may result in a use-after-free bug.  This patch moves the release\noperation after unlocking and putting the page.\n\nNOTE: The function in question is only called in GC, and in combination\nwith current userland tools, address translation using DAT does not occur\nin that function, so the code path that causes this issue will not be\nexecuted.  However, it is possible to run that code path by intentionally\nmodifying the userland GC library or by calling the GC ioctl directly.\n\n[konishi.ryusuke@gmail.com: NOTE added to the commit log]",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -53,9 +56,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-416"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-02T22:15:49Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4hjm-m2c9-868g",
-  "modified": "2024-03-03T00:30:32Z",
+  "modified": "2024-11-06T18:31:03Z",
  "published": "2024-03-03T00:30:32Z",
  "aliases": [
    "CVE-2023-52571"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: rk817: Fix node refcount leak\n\nDan Carpenter reports that the Smatch static checker warning has found\nthat there is another refcount leak in the probe function. While\nof_node_put() was added in one of the return paths, it should in\nfact be added for ALL return paths that return an error and at driver\nremoval time.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
+    }
  ],
  "affected": [

@@ -35,7 +38,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-02T22:15:49Z"
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-770"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8j2x-98w6-cr3m",
-  "modified": "2024-03-03T00:30:31Z",
+  "modified": "2024-11-06T18:31:03Z",
  "published": "2024-03-03T00:30:31Z",
  "aliases": [
    "CVE-2023-52512"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: nuvoton: wpcm450: fix out of bounds write\n\nWrite into 'pctrl->gpio_bank' happens before the check for GPIO index\nvalidity, so out of bounds write may happen.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -33,9 +36,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-787"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-02T22:15:47Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-fvm2-fqg3-334j",
-  "modified": "2024-03-14T00:31:05Z",
+  "modified": "2024-11-06T18:31:03Z",
  "published": "2024-03-08T03:31:25Z",
  "aliases": [
    "CVE-2024-23289"
  ],
  "details": "A lock screen issue was addressed with improved state management. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. A person with physical access to a device may be able to use Siri to access private calendar information.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -47,7 +50,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-08T02:15:50Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-g248-66hq-4f22",
-  "modified": "2024-03-11T18:31:10Z",
+  "modified": "2024-11-06T18:31:03Z",
  "published": "2024-03-11T18:31:09Z",
  "aliases": [
    "CVE-2024-26612"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs, fscache: Prevent Oops in fscache_put_cache()\n\nThis function dereferences \"cache\" and then checks if it's\nIS_ERR_OR_NULL().  Check first, then dereference.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -37,9 +40,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-476"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-11T18:15:19Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-g3ch-355r-26mp",
-  "modified": "2024-06-27T15:30:38Z",
+  "modified": "2024-11-06T18:31:03Z",
  "published": "2024-03-06T09:30:26Z",
  "aliases": [
    "CVE-2023-52585"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()\n\nReturn invalid error code -EINVAL for invalid block id.\n\nFixes the below:\n\ndrivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:1183 amdgpu_ras_query_error_status_helper() error: we previously assumed 'info' could be null (see line 1176)",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -53,9 +56,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-476"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-06T07:15:07Z"
--- a/Show More
+++ b/Show More